xiangduck.sld.tw: a server that handed out Mirai bot files for routers and cameras, and what to do if a device fetched them

What xiangduck.sld.tw is, and what we know about it

xiangduck.sld.tw is not a program on your PC. It is a web address that the abuse.ch project URLhaus lists as a place where malware files were offered for download. We found no public write-up of this one address, so what follows is what URLhaus shows, what our own request found, and what CISA, the FBI, HKCERT, Microsoft and researchers have published about Mirai, the family six of the files are tagged with.

1. 1

   What URLhaus lists

   Eleven file addresses at the top of xiangduck.sld.tw, all over plain http, all named violet followed by a dot and a short code: x86, arm, arm5, arm6, arm7, mips, mpsl, ppc, sh4, m68k and spc. All were added on 2 October 2026 between 15:55 and 16:11 UTC by the same reporter, and all carry the threat type malware_download.

2. 2

   What the endings mean

   The endings are processor families. x86 is the family of most PCs, arm and mips are common in home routers and cameras, mpsl is little endian MIPS, ppc is PowerPC, sh4 is SuperH, m68k is Motorola 68000 and spc is most likely SPARC. One build per chip is the classic pattern of a Mirai download server.

3. 3

   What the tags say

   Six of the eleven entries are tagged mirai: x86, arm, arm5, arm6, sh4 and m68k. The other five have no tag in our copy. That does not make them harmless; it only means nobody labelled them. Files offered side by side with the same name are almost always builds of the same program.

4. 4

   What we could not confirm

   We did not download any of the files, so we cannot tell you which Mirai variant they are, which controller they report to or which flaw was used to plant them. The name violet does not match any family name we found in vendor reports, so we do not treat it as one.

5. 5

   What this means for you

   If you only saw the name in a firewall, DNS or router log, nothing is infected by that alone. It does mean that a device on your network asked for it, and the device that asks for Mirai files is usually a router, camera or recorder that someone already got into.

Kind of threat

A download server for Mirai, a bot that turns routers, IP cameras and video recorders into a network used for denial of service attacks

Where the files were

hxxp://xiangduck[.]sld[.]tw/violet.<build>: eleven builds, one per processor family

Name registration

Not known. RDAP returned no record for the name, and we found no public page that says who runs sld.tw or how its names are given out

URLhaus entries

11 file addresses, all added on 2 October 2026; all 11 offline in our copy of the data on 8 October 2026

Our check

8 October 2026: a plain request from our server failed because the name did not resolve (ENOTFOUND)

Platform

Linux based routers, cameras, recorders and other small devices. Mirai builds do not run on Windows, macOS, iPhone or ordinary Android phones

What we checked on 8 October 2026, and what we could not

We made one plain request to the address from our server on 8 October 2026.

There is no screenshot, because there was nothing to load: the name did not turn into an internet address at all.

What happened to xiangduck.sld.tw, from the first report to our check

Everything we know about this address fits into one week.

The dates come from URLhaus and from our own request; nothing older is on public record that we could find.

1. Before 2 October 2026

   No record

   We found no public report, no RDAP record and no vendor page about xiangduck.sld.tw from before the URLhaus entries. When the name was set up is not known.

2. 2 October 2026, 15:55 UTC

   Ten files are reported within a few seconds

   violet.x86 is added at 15:55:25 UTC, then arm5, arm6, arm7, mips, sh4 and m68k at 15:55:26, spc at 15:55:27, arm at 15:55:28 and ppc at 15:55:37. Five of them carry the tag mirai.

3. 2 October 2026, 16:11 UTC

   The eleventh file

   violet.mpsl, the little endian MIPS build, is added at 16:11:31 UTC. It has no tag in our copy.

4. By 8 October 2026

   All files offline

   Our copy of the URLhaus data marks all eleven file addresses offline.

5. 8 October 2026

   Our check

   A plain request from our server finds no DNS address for xiangduck.sld.tw. We publish this guide with what is known and what is not.

   

What the pattern suggests, and what it does not: a full set of builds reported within seconds looks like an automated scan of one download folder, which is how researchers usually find these servers. It does not tell us how many devices fetched the files before the name went dark.

How a Mirai download server is used

A download server like this one is only one link in a chain.

The victim is not a person who clicks; it is a device with a weak password or an old flaw that a bot found on its own.

1. 1

   A bot scans the internet

   CISA describes Mirai as malware that keeps scanning the internet for vulnerable devices. Its original version tried a list of 62 common default user names and passwords, and CISA says that alone gave it hundreds of thousands of devices.

2. 2

   It gets a command line on the device

   With a default password, or with a known flaw in old router software, the attacker gets a shell on the device. CISA names Telnet on ports 23 and 2323, and a later variant used a flaw on port 7547 of broadband routers.

3. 3

   A short script fetches the builds

   Symantec, as reported by SecurityWeek in August 2018, found that the infection starts with a shell script that downloads and runs each build in turn until one matches the device. The SANS Internet Storm Center showed the same pattern in 2023 with ten files named after processor families.

4. 4

   The matching build runs from memory

   Only the build for the right chip starts; the rest fail. CISA says Mirai lives in memory, which is why a restart removes the running copy.

5. 5

   The device works for someone else

   The device now takes orders from a controller. It floods targets with traffic and scans for the next devices to infect, while it keeps doing its normal job for you.

What Mirai is

Mirai is not new.

Its source code became public in 2016, and since then many groups have built their own versions under new names. That is why the same file pattern keeps showing up on new addresses.

What a Mirai infection takes from you

Mirai is not built to read your files or your passwords.

What it takes is your device and your connection. That is still a real cost.

What this can cost you

The risk depends on which device asked for the files.

• High

  A router you rely on

  An infected router carries all your traffic. Even when Mirai only attacks others, the same open door that let it in is open to anyone.

• High

  An old device with no more updates

  The FBI and HKCERT both say end of life routers should be replaced, because their flaws will never be fixed and they are taken again after every restart.

• Medium

  A camera or recorder

  A camera that someone else controls is a privacy question too. Mirai does not watch video, but the access that let it in might.

• Medium

  Your connection and your address

  Slow internet, a full data cap and an IP address on block lists are the everyday costs of a device in a botnet.

• Low

  A Windows PC, a Mac or a phone

  Mirai builds are made for Linux on small devices. A Windows PC that only appears in a log next to this name is not running them.

• Low

  Nothing, if you only saw the name

  A name in a block list, a log or a warning is not an infection.

What you may notice, and what you may not

Most owners of an infected router or camera notice nothing.

The signs below come from CISA and the FBI.

How a device ends up asking for these files

A person rarely meets this address by clicking.

The device does, after someone got into it.

1. 1

   A default or weak password

   CISA says Mirai's first version used 62 common default user names and passwords. Cameras and recorders that were never given a new password are still the easiest target.

2. 2

   An unpatched or end of life router

   HKCERT reported Mirai attacks in 2026 on D-Link DIR-823X routers through CVE-2025-29635, and on old TP-Link and ZTE routers. A router that no longer gets updates keeps such flaws forever.

3. 3

   Remote management or Telnet open to the internet

   The FBI found router malware on devices with remote administration turned on, and CISA says to watch ports 23 and 2323 for Telnet attempts. Any login page reachable from the internet is a door.

4. 4

   Port forwarding and UPnP

   CISA advises turning off UPnP on routers unless it is needed, because it lets devices open ports to the internet on their own.

Check your devices before you change anything

Start with the question that matters: which device asked for xiangduck.sld.tw? If you saw the name in a router, firewall or DNS log, the device and the time are in that log. Only that device is in question, not every device you own.

If the log points at a Windows PC rather than a router or camera, the PC is not running these Linux files, but something on it made the request. Check that PC with the plan further down this page.

1. 1

   Find the device by its address

   Most router pages have a list of connected devices with their local IP and MAC address. Match the address in the log to a name. A camera, a recorder or the router itself is the likely answer.

2. 2

   Look at the router's settings

   Sign in to the router's admin page and look at remote management, port forwarding, UPnP and DNS servers. The FBI names changed settings as a sign; write down anything you did not set.

3. 3

   Check the firmware date and the model's support status

   Find the model on the maker's site. If the maker says the model is end of life or there is no update from the last few years, plan to replace it.

4. 4

   Ask your provider

   If your provider warned you about attack traffic, ask for the time and kind of traffic. It helps you match it to one device.

5. 5

   A clean look proves little

   Mirai lives in memory and hides in normal looking processes. A router page that looks normal is one data point, not a clean result.

Which of your devices can run these files

The eleven files are builds for small Linux devices.

This table says what each kind of device you own has to fear from them.